Preaching What We Practice: Teaching Ethical Decision-Making to Computer Security Professionals

Preaching What We Practice:Teaching Ethical Decision-Making toComputer Security Professionals Kenneth R. Fleischmann, Ph.D. College of Information Studies University of Maryland

The Real Problem?

Values • Values are formed at a very early age

Technological Somnambulism Winner, L.: The Whale and the Reactor. University of Chicago Press, Chicago (1986)

Value Tradeoffs Automatic Security Updates User Autonomy Caring

Value Tradeoffs Online Voting Systems Convenience Security

Value Tradeoffs Manual Spam Filtering Efficiency Privacy

Values Embedded in IT • “It is unethical to ignore the values embedded in technological artifacts” Martin, C.D., Huff, C.W., Gotterbarn, D., Miller, K.: Implementing a Tenth Strand in the CS Curriculum: The Second Report from Project ImpactCS. Comm. ACM 39, 75--84 (1996), p. 80

Two Research Projects • 1. Understanding ethical decision-making • Mixed-method field research in research labs • Values of modelers in different organizations • The role of professional codes of ethics • 2. Increasing awareness of ethical decisions • Action research in computing ethics education • Learning from multiple roles and decision points • Learning from different forms of collaboration

Project 1: Mixed-Method Field Research • Objective: study the role of values in the design of computational models • Collaborator: William A. Wallace, Rensselaer Polytechnic Institute • Funding: National Science Foundation Ethics and Values Studies Program

Field Sites Corporate Lab January, 2006-April, 2006 Academic Lab July, 2007-April, 2008 Government Lab October, 2007-May, 2008

Data Collection • Online Survey (76 completed) • Demographic questions • Schwartz Values Survey (Likert-Style) • Yes/No questions • Interviews (40 completed) • Semi-structured and open-ended • List of questions built using survey responses • Focus Groups at Beginning and End

Data Collection: Survey How important are each of the following values as a guiding principle in your life?

Data Analysis: Surveys • Compare values for three organizations • Split responses into groups • Compare self-reported scores for each value • Analyze data using Kruskal-Wallis H followed by Mann-Whitney U

Data Analysis: Interviews • Qualitative content analysis of interviews • Researchers independently coded 40 interviews using the Schwartz Values Survey as the coding frame • Researchers achieved consensus on whether or not a value was present and which value(s)

Data Analysis: Interviews • Compare counts for three organizations • Split responses into groups • Count frequencies for each value coded • Analyze data using Kruskal-Wallis H followed by Mann-Whitney U

Values in Different Organizations • Research Questions: • Are there differences in modelers’ conscious and acknowledged adherence to particular values within different organizations? • Are there differences in the extent to which values are salient within different organizations?

Results: Schwartz Value Survey

Schwartz Value Survey Corporate Academic Government

Schwartz Value Survey Unity with Nature Curious Loyal Honoring of Parents and Elders Obedient Corporate Academic Clean Government

Schwartz Value Survey Unity with Nature Curious “I do this for intellectual stimulation.” Loyal Honoring of Parents and Elders Obedient Corporate Academic Clean Government

Schwartz Value Survey Unity with Nature Curious “The technical problem was very interesting.” Loyal Honoring of Parents and Elders Obedient Corporate Academic Clean Government

Schwartz Value Survey Unity with Nature Curious Not mentioned Loyal Honoring of Parents and Elders Obedient Corporate Academic Clean Government

Schwartz Value Survey Unity with Nature Curious New employees honor “the old guys” Loyal Honoring of Parents and Elders Obedient Corporate Academic Clean Government

Schwartz Value Survey Unity with Nature Curious Modelers honor managers Loyal Honoring of Parents and Elders Obedient Corporate Academic Clean Government

Schwartz Value Survey Unity with Nature Curious Students honor faculty Loyal Honoring of Parents and Elders Obedient Corporate Academic Clean Government

Results: Interview Value Counts

Interview Value Code Frequency Corporate Academic Government

Interview Value Code Frequency Equality A World at Peace Influential Capable Responsible Wealth Authority Healthy Corporate National Security Accepting My Portion in Life Academic Government

Interview Value Code Frequency “University campuses tend to be quite liberal, anti-war, yet much of the money is coming from the defense department.” Equality A World at Peace Influential Capable Responsible Wealth Authority Healthy Corporate National Security Accepting My Portion in Life Academic Government

Interview Value Code Frequency Equality “I guess the example I gave before where I made a mistake ...after I corrected my mistake, then the model was better, although it may not have been the best news, but it may have been a better model.” A World at Peace Influential Capable Responsible Wealth Authority Healthy Corporate National Security Accepting My Portion in Life Academic Government

Interview Value Code Frequency Equality “When you’re presented with data, be responsible with it. In terms of analysis, certainly you want to be careful and honest about how you report your data.“ A World at Peace Influential Capable Responsible Wealth Authority Healthy Corporate National Security Accepting My Portion in Life Academic Government

Interview Value Code Frequency “We go to conferences and talk about these models, nobody stops and asks questions about whether it’s a good thing or a bad thing.” Equality A World at Peace Influential Capable Responsible Wealth Authority Healthy Corporate National Security Accepting My Portion in Life Academic Government

Summary of Results • Survey results show differences in adherence to values among individuals in different organizations • Interview results show differences in the occurrence of values among individuals in different organizations

Professional Codes of Ethics • Research Questions: • Is there a relationship between awareness of professional codes of ethics and modelers’ values? • Is there a relationship between familiarity with professional codes of ethics and modelers’ values? • Is there a relationship between attitudes toward professional codes of ethics and modelers’ values?

p<0.001 p<0.001 p<0.01 p<0.01 p<0.01

p<0.05 p<0.05 p<0.05 p<0.05 p<0.05

Code of Ethics: Why? • “I think…it will lead to better results, actually. If you follow a code of ethics, it means you’re doing the best for yourself, for other people, and you’re creating a model that’s as true to reality as it can be, with the data that you have.”

Preaching What We Practice: Teaching Ethical Decision-Making to Computer Security Professionals